Guides

Import and export

Bring variables in from .env files and other secret managers, and keep them out of git.

Import from a file

dotsafe import                        # ./.env into the linked environmentdotsafe import .env.production -e productiondotsafe import secrets.json           # JSON exported by Doppler, Infisical or 1Password

In the app, drop .env files on the window, or use Import. You see what will change before anything is saved.

Import from another secret manager

dotsafe can read straight from another tool's CLI, if it's installed and signed in:

dotsafe import --from doppler             # the project and config set up in this directorydotsafe import --from infisical           # the project linked in this directorydotsafe import --from 1password --item "my-api prod"   # one item's fields, by label

Export

Prefer dotsafe run, which never writes values to disk. For tools that only read a file:

dotsafe export                 # print .env linesdotsafe export -o .env         # write a file

A written file is readable by you only. dotsafe refuses to write it if git would commit it; add it to .gitignore first, or pass --force.

Keep values out of git

dotsafe scan looks through files for any value in your vault, as is or encoded (base64, hex, URL encoding). It reports names and places, never the values.

dotsafe scan                   # this directorydotsafe scan src/ config/      # some pathsdotsafe scan --install-hook    # a pre-commit hook that runs `dotsafe scan --staged`